# Filter\_parameter\_logging on "dynamic" parameters **URL:** \ **Category:** Rails\ **Created:** [April 25, 2010, 4:53pm UTC](https://www.ruby-forum.com/t/filter-parameter-logging-on-dynamic-parameters/187553 "2010-04-25T16:53:09Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jolivierld](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/34f0e0/32.png) [@jolivierld](https://www.ruby-forum.com/u/jolivierld)\ **Post date:** [April 25, 2010, 4:53pm UTC](https://www.ruby-forum.com/t/filter-parameter-logging-on-dynamic-parameters/187553/1 "2010-04-25T16:53:09Z")
Hi, I’m using the negative\_captcha plugin for my signup form on a website, and I’d like to have the parameters filtered out in my logs. My problem is : negative\_captcha replaces the parameters names with some md5 hashes in a before\_filter and leaves the uncrypted parameter as a honeypot to identify bots. So if I use filter\_parameter\_logging :password, I end up with this line in my logs : Parameters: {… “829334b5e733bd4eefa3d2e02337a7e1”=\>“PASSWORD”, “password” =\> “[FILTERED]” …} That’s obviously not what I want. I thought I could add @captcha.fields[:password] as a parameter, but filter\_parameter\_logging is a Class method so @captcha is nil when it’s called. I’m out of idea for this, would anyone have a solution or some tips about this ? ---
**Author:** ![jolivierld](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/34f0e0/32.png) [@jolivierld](https://www.ruby-forum.com/u/jolivierld)\ **Post date:** [April 25, 2010, 5:15pm UTC](https://www.ruby-forum.com/t/filter-parameter-logging-on-dynamic-parameters/187553/2 "2010-04-25T17:15:39Z")
On Apr 25, 3:53 pm, Olivier L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > That’s obviously not what I want. I thought I could add > @captcha.fields[:password] as a parameter, but filter\_parameter\_logging > is a Class method so @captcha is nil when it’s called. > > I’m out of idea for this, would anyone have a solution or some tips > about this ? If you give filter\_parameter\_logging a block it will yield parameter names/values to that block and you can make the decision to filter on a case by case basis. Is that enough for you ? Fred ---
**Author:** ![jolivierld](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/34f0e0/32.png) [@jolivierld](https://www.ruby-forum.com/u/jolivierld)\ **Post date:** [April 25, 2010, 5:20pm UTC](https://www.ruby-forum.com/t/filter-parameter-logging-on-dynamic-parameters/187553/3 "2010-04-25T17:20:12Z")
Thanks for the quick reply 🙂 > If you give filter\_parameter\_logging a block it will yield parameter > names/values to that block and you can make the decision to filter on > a case by case basis. Is that enough for you ? I’ve tried this, but again the fact that filter\_parameter\_logging is a class method does not help… filter\_parameter\_logging (:some, :other, :parameters) { |k,v] v.replace “[FILTERED]” if @captcha.fields.include? k } raises an exception saying @captcha is nil. Which is normal, as it is initialized in a before\_filter invoked after the call to filter\_parameter\_logging… ---
**Author:** ![jolivierld](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/34f0e0/32.png) [@jolivierld](https://www.ruby-forum.com/u/jolivierld)\ **Post date:** [April 25, 2010, 5:21pm UTC](https://www.ruby-forum.com/t/filter-parameter-logging-on-dynamic-parameters/187553/4 "2010-04-25T17:21:34Z")
what I didn’t mention and is the core of this problem, is that those captcha parameters are salted, so they are different for each and every client. That’s why I need to access the initialized @captcha object… ---
**Author:** ![jolivierld](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/34f0e0/32.png) [@jolivierld](https://www.ruby-forum.com/u/jolivierld)\ **Post date:** [April 25, 2010, 6:23pm UTC](https://www.ruby-forum.com/t/filter-parameter-logging-on-dynamic-parameters/187553/5 "2010-04-25T18:23:35Z")
On Apr 25, 4:20 pm, Olivier L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > v.replace “[FILTERED]” if @captcha.fields.include? k > > } > > raises an exception saying @captcha is nil. Which is normal, as it is > initialized in a before\_filter invoked after the call to > filter\_parameter\_logging… Is it not possible to work out whether a parameter name looks like a captcha parameters ? Failing that, all filter\_parameter\_logging does is define an instance method called filter\_parameters - you could define such a method without the help of filter\_parameter\_logging (although you might want to inspire your self from the source for filter\_parameter\_logging to understand what the filter\_parameters method should look like) Fred ---
**Author:** ![jolivierld](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/34f0e0/32.png) [@jolivierld](https://www.ruby-forum.com/u/jolivierld)\ **Post date:** [May 16, 2010, 11:53pm UTC](https://www.ruby-forum.com/t/filter-parameter-logging-on-dynamic-parameters/187553/6 "2010-05-16T23:53:45Z")
Hi Fred, I’m sorry I took so long to answer, I was busy with other developments… Thanks for the filter\_parameters idea, that was the solution for me. Guessing whether a parameter name is a captcha worked well too but I couldn’t be selective enough: I had to filter all parameters looking like a MD5 hash, whereas I’d like to keep emails appearing in my logs on signups in case I have to trace back a problem from a user. So I defined a filter\_parameters method, which is mainly taken from Rails source. I defined my parameter\_filter out of a constant array to emulate filter\_parameter\_logging mechanism. This array contains the params names I was giving to filter\_parameter\_logging, plus the captcha params I want to filter out. I actually don’t know how and why my own filter\_parameters method gets called. Any pointer on that? Would you know of any way to keep a filter-like way of calling this? (like adding my\_own\_filter\_parameter\_logging :param1, :param2) Thanks for your help! Olivier Frederick C. wrote: > On Apr 25, 4:20�pm, Olivier L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > � v.replace “[FILTERED]” if @captcha.fields.include? k > > > > } > > > > raises an exception saying @captcha is nil. Which is normal, as it is > > initialized in a before\_filter invoked after the call to > > filter\_parameter\_logging… > > Is it not possible to work out whether a parameter name looks like a > captcha parameters ? Failing that, all filter\_parameter\_logging does > is define an instance method called filter\_parameters - you could > define such a method without the help of filter\_parameter\_logging > (although you might want to inspire your self from the source for > filter\_parameter\_logging to understand what the filter\_parameters > method should look like) > > Fred